Complete the archive side of 9cdf6da's follow-up budget work. Bound actual
retained metadata anchors before target/context growth and keep tail index
validation/counting for admitted windows. Replace whole-window body collection
with a row callback that checks the shared deadline, exact snapshot identity,
column types, byte lengths and aggregate admission before retaining output.
Guard role/content transfer in SQL with length(CAST(... AS BLOB)), so UTF-8
multibyte text and text after embedded NUL cannot bypass the 8 MiB pair limit.
Verify returned text is complete, preserve nullable defaults and role mapping,
and cap retained normalized text at 32 MiB / 4096 records. All refusals preserve
the original structured error and emit no partial canonical target. No live
source fallback, repairs, maintenance or archive mutation.
Add a bounded-selection unit regression and three real-binary tests covering
oversized multibyte/NUL content and roles, excluded-body isolation, aggregate
window refusal with a successful narrow control, and 4096-row tail admission.
Retain previous identity/sparse-index/invalid-payload tests and document limits.
These bounds do not promise process-wide RSS or interruption inside an engine
or kernel call; SQL byte guards do not bound engine-internal value allocation.
Exact-source preparation, pinned rustfmt and 11 std-only streaming/selection
tests passed in run 35675824398. Downloaded candidate blobs and documentation
match reviewed local Git hashes. Full native CLI/Clippy jobs remain in progress;
local RCH/UBS are unavailable (127). No blanket green-build or bead closure.
Restore candidate workflow to read-only. Preserve concurrent publication, MCP
and search work through fdfcfe88. Direct main via GitHub, no PR or force update.
Related: coding_agent_session_search-cass-fleet-resilience-20260608-uojcg.2.6.
Retain main's one-based --message-index implementation and finish the
quick reference's search-follow-up workflow: preserve database, source,
conversation and message coordinates instead of passing ordinals to raw -n.
Add four native regression tests for the reported 129/67/90 and 541/2375
coordinate divergences, preserved tool output/role and archived text, sparse
context and missing-target refusal, pretty-printed JSON, unchanged source
and database bytes, and the quickstart command contract. These fixtures seed
canonical rows deliberately; they do not claim provider-ingestion coverage.
Run the new independent target before the existing real search round-trip
suite. Keep that suite unchanged: baseline Actions run 35557394971 compiled
and passed 14/15 tests, with its round-trip setup failing on Quill's Boolean
segment-domain invariant during targeted reconcile. Do not hide that failure.
Validation: original and uploaded blob identities verified, diff whitespace
and YAML syntax passed, and Python equivalents of the documentation checks
fail on the old quickstart and pass on the new one. Native execution,
rustfmt and Clippy for this new target are not available locally; CI remains
the native validation gate. Preserve concurrent schedule commit 38964fa.
No PR and no force update.
Land the reviewed and rustfmt-checked canonical-coordinate candidate prepared
against 46a144c, preserving all concurrent main changes. Add explicit
--message-index to view/expand with source/conversation disambiguation,
read-only snapshot resolution, sparse-index handling and bounded output.
Remove raw expand's nearest-record substitution so nonexistent file lines
cannot produce an invented target. Document coordinate and stale-hit limits.
Include nine CLI regression tests and wire the permanent regression workflow
to the actual test target. Candidate formatting and git diff --check passed
in GitHub Actions run 35555939810. Native tests and Clippy are still running;
this commit does not claim a passing Rust build or runtime qualification.
Direct main delivery requested by the owner; no PR and no force update.
The remainder of the release batch: operator-facing analytics/dashboards plus
the daemon, indexer, and storage plumbing they depend on.
- analytics (derive/query/types) and UI (analytics_charts, app) with the pages
bundle/wizard, operations_dashboard, pages_assets/stats.js, and the
cass-pages-perf-bundle binary.
- daemon (client/core/models/worker/mod + runtime state), indexer/mod +
quarantine, storage/sqlite, bookmarks, metric_integrity, dependency_drift,
guide_runner, connector_ingest_diagnostics, swarm_status, and the
conversation_packet model.
- e2e gates covering onboarding, lessons, guided-ops golden, guide-apply,
storage-failure fixtures, operations-dashboard contract, bounded
quarantine-retry, pages bundle, robot-json, and the 256/baseline feature gate;
golden fixtures refreshed. Docs (architecture summary, quick reference, modes
report) and AGENTS/README/Cargo/build.rs updated in step.
Co-Authored-By: Claude <noreply@anthropic.com>
Builds out the hybrid search stack described in the semantic-search plan.
- Embedders behind an `embedder_registry`: `hash_embedder` (FNV-1a feature
hashing as an explicit degraded mode), `fastembed_embedder` (pure-Rust native
MiniLM), with `model_download` / `model_manager` handling the local model
lifecycle and `pack_planner` sizing the work.
- Reranking via `reranker_registry` (pure-Rust cross-encoder) and RRF-style
fusion in search/query; `trust_scoring` + `trust_correlation` weight results
and `storage_integrity` / `contention_diagnostics` keep the vector path safe.
- indexer/semantic drives semantic indexing; citation-path comparisons annotated
`ubs:ignore` (public paths, never secret material).
- Planning + reference docs and bakeoff scripts capture the design and the
trust-meta e2e gate.
Co-Authored-By: Claude <noreply@anthropic.com>
Continuation of 66cee372 ("chore(repo): reorganize evidence trees") — the
FTUI visual-parity bundle and the cass bakeoff validation note still lived at
the top of `docs/`, surrounded by living references. Move them into the
named subtrees the prior reorg established and tighten the scratch-output
ignore list so the next round of skill-loop runs can't re-pollute the repo
root.
Moves (content-identical, verified by diff against deleted blobs):
- `docs/ftui_feature_audit.md` → `docs/artifacts/ftui-parity/feature_audit.md`
- `docs/ftui_parity_baseline_bundle.md` → `docs/artifacts/ftui-parity/baseline_bundle.md`
- `docs/ftui_visual_parity_manifest.json`→ `docs/artifacts/ftui-parity/visual_parity_manifest.json`
- `docs/cass_bakeoff_validation.md` → `docs/reference/cass_bakeoff_validation.md`
The first three are "captured run artifact" by definition (manifest + audit
+ baseline bundle) so they belong under `docs/artifacts/`. The bakeoff note
is a living reference (operators consult it; it isn't a snapshot of one
campaign), so it goes under `docs/reference/`.
`docs/ftui_visual_parity_rubric.md` keeps its top-of-`docs/` location (it's
the active scoring rubric, a living reference) but its single pointer to the
old manifest path is updated to the new artifact location.
`docs/artifacts/README.md` registers the new `ftui-parity/` subtree and
explains why the rubric stays put while the manifest moves.
`.gitignore` adds repo-root scratch outputs that the agent-ergonomics
skill loop kept regenerating and accidentally tracking:
/DASHBOARD.md, /final_dashboard.md, /baseline.md, /architecture.md,
/pass*.md, /duplication_map.*, /skill_inventory.json, /slop_scan.md,
/loc_delta_*.numstat, /baseline_*.log, /cargo_*.log,
/touched_rustfmt_check.log, /validation_report.json,
/per_query_scores.json
Durable plans go under `docs/planning/`, durable evidence under
`docs/artifacts/`, reference guides under `docs/reference/` — these patterns
hard-block the corresponding scratch outputs from creeping back in at root.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pulls all of the long-form evidence the project has been accumulating
into a small, named set of `docs/` subtrees and tightens `.gitignore`
plus the CI hygiene gate so freshly-generated scratch artifacts cannot
quietly become tracked again. Pure repo-hygiene change: no application
code, schema, or build behavior is touched.
New canonical locations under `docs/`:
- `docs/artifacts/` is the durable home for evidence we want to keep
reviewable in-tree: migration baselines, refactor proof bundles, the
no-mock CI audit, and per-pass simplification dashboards. A new
`docs/artifacts/README.md` documents the policy: anything under here
is curated evidence, not scratch.
- `docs/artifacts/migration-baseline/` absorbs the entire former
`.beads/migration_baseline/` tree (BASELINE_SUMMARY, SUMMARY, all
`baseline_*.{log,txt,json}` outputs, the `search_quality/*.json` and
`search_queries/q*.json` fixtures, and `binary_size.txt`) plus a new
`fs_verification.log` so the migration evidence is not buried under a
beads daemon directory.
- `docs/artifacts/refactor-runs/` collects every dated
`20260424T*` … `20260427T*` and `20260428T*` codex/repeated-simplify
pass directory that previously lived under `refactor/artifacts/`.
Every per-pass report (`pass1_*.md` … `pass10_*.md`, `DASHBOARD.md`,
`architecture.md`, `baseline.md`, plus the Twelfth/Thirteenth
twelve-pass dashboards) moves verbatim — only the path changes.
- `docs/artifacts/no-mock-audit.md` replaces
`test-results/no_mock_audit.md` as the durable copy of the no-mock
policy report; the `test-results/` directory is now treated as
ephemeral.
- `docs/assets/` becomes the project's image / screenshot home, with a
new `docs/assets/README.md`. `cass_illustration.webp`,
`gh_og_share_image.jpg`, and `screenshots/screenshot_0{1,2,3}.webp`
move out of the repo root into `docs/assets/images/` and
`docs/assets/screenshots/`.
- `docs/planning/` gains the formerly root-level
`cli-robot-enhancements.md` and the dated investigation
`2026-05-05-franken-agent-detection.md` (now under
`docs/planning/sessions/`), so all planning material is in one
predictable subtree.
- `docs/reference/E2E_LOGGING_SCHEMA.md` is added as the durable
schema definition for the JSONL E2E log, replacing inline references
to `tests/e2e/exports/setup-metadata.json` paths.
- `tests/policies/` becomes the home for machine-enforced policy
inputs. `test-results/no_mock_allowlist.json` moves to
`tests/policies/no_mock_allowlist.json` so that CI-relevant policy
files survive `test-results/` being ignored.
- `tests/performance/lighthouse-budget.json` moves to
`tests/fixtures/performance/lighthouse-budget.json` to consolidate
test inputs under `tests/fixtures/`.
Tracked-artifact hygiene (`.gitignore`):
- Search-demo data: keeps the frozen v1 index and `watch_state.json`
visible (`!tests/fixtures/search_demo_data/index/`,
`!.../watch_state.json`, `!.../v1/**`) while ignoring later
scratch generations (`v*/` minus `v1/`), `index-run.lock`, the
doctor scratch directory, and the `.lexical-publish-backups/`
staging tree.
- Test outputs: `test-results/*` is now ignored wholesale (no
per-file allowlist; durable inputs live under `tests/policies/`).
`/test-results-*.txt`, `claude-upgrade-progress.json`,
`tests/test-results/`, `tests/tests/`, `tests/e2e/exports/`,
`tests/e2e/pages_preview/`, `tests/artifacts/`, `tests/e2e/.env.test`,
and root-level `/artifacts/` and `tmp/` are all explicitly ignored.
- Local SQLite sidecars: `*.db-wal`, `*.db-shm`, `*.db-journal`,
`*.sqlite-wal`, `*.sqlite-shm`, `*.sqlite-journal`, `*.sqlite3-wal`,
`*.sqlite3-shm`, `*.sqlite3-journal` are added globally so
process-local journal files cannot leak in next to a deliberately
checked-in fixture DB. Root-level `/*.db`, `/*.db-wal`,
`/*.db-shm`, `/*.sqlite`, `/*.sqlite-wal`, `/*.sqlite-shm` follow
the same rule.
- Aider state: `.aider.chat.history.md` and friends remain ignored
globally, with an explicit
`!tests/fixtures/aider/.aider.chat.history.md` exception so the
intentional fixture survives.
- Root noise: `/cass_illustration.webp`, `/gh_og_share_image.*`,
`/screenshots/`, `/UPGRADE_LOG.md`, `/refactor/`, `/perf/`,
`/*.log`, `/*.mcp.json`, `cline.mcp.json`, `opencode.json`,
`*.mcp.json.*.bak`, and `__pycache__/` plus `.ruff_cache/` are
explicitly ignored at root so future regenerations of these
artifacts do not become tracked.
- Preserved-by-name carve-out: an explicit
`!docs/planning/MODES_OF_REASONING_REPORT_AND_ANALYSIS_OF_PROJECT.md`
re-include line guards against developer-level globals that still
match the pre-reorganization scratch filename.
Ephemeral artifact removals (now ignored):
- `.ntm/logs/am-coding_agent_session_search.log`,
`.ntm/logs/bd-coding_agent_session_search.log`,
`.ntm/logs/cm-coding_agent_session_search.log`, and
`.ntm/summaries/coding_agent_session_search-20260407-115237.json`
(~230 lines, all NTM session bookkeeping).
- `tests/e2e/.env.test` (regenerated per run).
- `tests/e2e/exports/setup-metadata.json`, `test-basic.html`,
`test-encrypted.html`, `test-large.html`, `test-no-cdn.html`,
`test-tool-calls.html`, `test-unicode.html` (~41,400 lines of
generated Playwright export HTML).
- `tests/e2e/pages_preview/bundle/{private,site}/*` — the entire
generated preview bundle (HTML, JS, CSS, payload chunk, master-key
+ integrity-fingerprint scratch). All produced by the preview build
step.
- `tests/e2e/pages_preview/db/agent_search.db{,-shm,-wal}`,
`tests/e2e/pages_preview/encrypt/{config.json,payload/chunk-00000.bin}`,
`tests/e2e/pages_preview/export/export.db`,
`tests/e2e/pages_preview/preview-server.log` (binary test DBs and
encrypt/export scratch produced by the preview server).
- `tests/tests/test-results/e2e/placeholder` (zero-byte placeholder).
Total: ~52,900 deletion lines removed, all generated test artifacts
that the new `.gitignore` patterns now block from re-entering the tree.
CI gate (`.github/workflows/ci.yml` + `scripts/validate_ci.sh`):
- A new "Run repository artifact hygiene check" step runs
`./scripts/validate_ci.sh --artifact-hygiene-only` first, before the
no-mock policy check, so the build fails fast if any of the patterns
above ever become tracked again.
- The no-mock workflow step is repointed at the new policy location
(`tests/policies/no_mock_allowlist.json`); the in-workflow
remediation guidance string in `AUDIT_REPORT` is updated to match.
- `scripts/migration_e2e_validate.sh` and `scripts/lib/e2e_log.sh`
are repointed to the new schema doc and policy paths.
- `tests/e2e/reporters/jsonl-reporter.ts` and `tests/util/e2e_log.rs`
reference the moved schema doc.
Companion docs (no behavioral change):
- `README.md` updates `<img>` `src` attributes for the project
illustration and the three TUI screenshots to point at the new
`docs/assets/...` paths, and adds a Remote Archive Safety subsection
documenting that `cass doctor`/`health`/`status` JSON treats
`remote_source_*` gaps as preservation signals (no behavior change,
doc only).
- `docs/planning/TESTING.md` adds an "Artifact hygiene check" intro
paragraph and a Doctor-V2 filesystem-portability section that names
the `CASS_TEST_DOCTOR_RENAME_FAILURE=cross-device` simulation and
the `fallback_kind: cross_device_copy_replace` evidence contract.
- `docs/planning/UPGRADE_LOG.md`, `docs/ftui_visual_parity_*` are
re-pointed at the new artifact paths.
- `tests/fixtures/README.md` and `tests/fixtures/sources/probe/README.md`
pick up the new path references.
Four documents at the repo root form a tightly cross-linked reference
cluster about the CASS search architecture: SEARCH_PATTERNS_INDEX.md
is the entry point that links into QUICK_REFERENCE.md (TL;DR + lookup
tables), CASS_SEARCH_PATTERNS.md (full architectural deep-dive), and
CASS_ARCHITECTURE_SUMMARY.txt (ASCII-art diagrams). They reference
each other by bare filename in over 30 places across the four files.
Move them as a unit so the relative-filename links keep resolving
inside the same docs/reference/ directory; no link rewriting needed.
The cluster joins the existing docs/ docs (ACCESSIBILITY.md,
ERROR_CODES.md, etc.) rather than continuing to crowd the workspace
root. README.md does not link to any of these files directly, so the
move is a pure relocation from a build/CI standpoint.
Co-Authored-By: Claude <noreply@anthropic.com>
Jeff Emanuel